# Sync Host (OneSyncSvc) Windows service: Microsoft Also called OneSyncSvc, Sync Host Supports synchronization of supported user data for a signed-in account. ## What you need to know Supports synchronization of supported user data for a signed-in account. Removing account data or changing templates can affect multiple applications. Preserve unsynchronized changes and use the affected application's supported recovery path. - **What does Sync Host do?**: Supports synchronization of supported user data for a signed-in account. **Can I disable Sync Host?**: Removing account data or changing templates can affect multiple applications. Preserve unsynchronized changes and use the affected application's supported recovery path. Confirm the installed feature and its effective policy before changing startup behavior. **Why is Sync Host stopped?**: Per-user instances follow the affected session and template lifecycle. Identify the correct suffixed instance and reproduce the feature before treating a stopped state as a failure. **Is a process using Sync Host safe?**: Check the actual running file, its signer, path and behavior. A familiar service name or a matching filename alone cannot establish safety. ## What this service does and when to investigate it Supports synchronization of supported user data for a signed-in account. Investigate this service when its own state or event evidence coincides with the affected feature. A similar name in Task Manager, a single resource-usage sample or a stopped state without a failing workload is not a diagnosis. Begin with the exact operation described below and keep the system's original configuration available for comparison. ## Windows editions, service names and startup assumptions For this exact service, the referenced IoT Enterprise table records a startup category of Automatic. This is a documented example for the specified IoT environment, not a measurement of your computer. Compare the local StartMode and the effective management policy before treating a difference as a fault. Microsoft's IoT Enterprise service table identifies this component under its service identifier. That table covers fixed-function Windows IoT Enterprise devices, including documented Windows 10 and Windows 11 variants. Its startup and disablement guidance is scoped to those scenarios; it is not a blanket tuning recommendation for consumer Windows, every enterprise image or every Windows Server installation. Service availability can depend on the installed edition, build, optional features, account context and organizational configuration. Use winver or your managed inventory to record the installed build. Compare it with the product scope on the linked Microsoft pages. If a source discusses a different edition or an older Windows Server baseline, use it to understand the feature rather than copying its default settings. A per-user template is different from the session-specific instances created from it. Find the instance associated with the affected user rather than copying a suffix from another computer or an old screenshot. Different Windows builds can expose different templates. ## Inspect the actual registration before changing it The following examples are local, read-only inspection commands for Windows PowerShell. They do not install, stop, restart, enable or disable a service. Use an authorized account; some fields and logs can require administrative access. Do not run commands in an untrusted remote session. `Get-CimInstance Win32_Service | Where-Object { $_.Name -like 'OneSyncSvc_*' } | Select-Object Name,DisplayName,State,StartMode,StartName,ProcessId,PathName` The wildcard lists candidate user instances. Match the instance to the affected signed-in user and copy its actual Name value. In the commands below, replace ACTUAL_SUFFIX with that observed suffix; do not run the placeholder literally. `sc.exe query "OneSyncSvc_ACTUAL_SUFFIX"` `sc.exe qc "OneSyncSvc_ACTUAL_SUFFIX"` Use sc.exe explicitly in Windows PowerShell, where the shorter sc spelling can resolve to a different command. Read the returned state and configuration before deciding what needs investigation. A query returning access denied requires an authorization check; a query reporting an absent service requires a product and installation check, not immediate registry reconstruction. ## Check dependencies and the host process Inspect both prerequisites and reverse dependencies on the affected computer. RequiredServices lists registered prerequisites; DependentServices lists services that declare a dependency on this one. These are installed service-control relationships, not an exhaustive map of every application, scheduled task or remote system that might rely on the feature. `Get-Service -Name 'OneSyncSvc_ACTUAL_SUFFIX' -RequiredServices` `Get-Service -Name 'OneSyncSvc_ACTUAL_SUFFIX' -DependentServices` Use the observed ProcessId to identify a running host, and compare its executable path and signer using Task Manager or a trusted Microsoft Sysinternals tool. If the reported process ID is zero or there is no running instance, there is no live host to inspect through that value. If a host contains several services, its total CPU or memory usage cannot be assigned to this service from the process name alone. Process identifiers can be reused. Record the observation time and recheck the identifier before taking action. Do not end a shared Service Host to test a single service; that can interrupt other hosted components. ## A focused troubleshooting sequence Find the correct suffixed instance and identify the particular account and data type that fails to synchronize. Compare local changes with the remote source of truth. Record the application's own synchronization error and relevant account permissions. A successful interactive sign-in does not prove background synchronization is authorized. A per-user template is different from the session-specific instances created from it. Find the instance associated with the affected user rather than copying a suffix from another computer or an old screenshot. Different Windows builds can expose different templates. 1. Write down the exact failing operation, affected account, device or endpoint, and the time it failed. Keep the full error text before closing the dialog. 2. Capture the service state and configuration on that same machine. Compare whether the feature is missing, denied by policy, unable to start, or failing after it starts. 3. In Event Viewer, compare Service Control Manager entries in the System log with the relevant application or feature channel around the recorded time. Confirm provider and message context before using an event ID found online. 4. Reproduce once with the smallest supported comparison described in this article. If the result differs, record which stage changed rather than immediately applying a broad reset. 5. Use the feature-specific Microsoft or vendor repair path justified by the evidence, then repeat the original operation and verify its result. If no relevant service-control error is present, continue with the feature or application investigation rather than forcing a restart. Conversely, a service-start failure needs its actual exit status and surrounding events; a generic timeout message alone does not identify a single repair. ## Stopped, manual or not found: what the result means Running describes current state; startup mode describes configuration. A manually started or event-triggered service may be stopped between requests. Reproduce the supported feature operation and compare the state transition before concluding that it should remain running all the time. A service disappearing when the user signs out can be expected lifecycle behavior. Do not delete registry templates or force a template into a permanent instance to repair one session. Compare another authorized session only when that comparison preserves user privacy and unsynchronized work. A start operation can fail because of its prerequisites, configuration, account permissions, feature state or the component it launches. Avoid applying a fixed startup value copied from a different Windows edition or image; compare the actual managed baseline for this computer. ## Investigating high CPU, memory, disk or network use Capture a short time series while reproducing the actual workload. Separate a short burst associated with sign-in, setup, synchronization or an update from work that repeatedly fails to complete. Record the application workload and the interval used for comparison; this article does not prescribe a universal safe percentage or memory threshold. Use the current process mapping and an appropriate performance tool to connect resource activity with the requesting feature. A shared host's working set is not a per-service allocation, and a status label does not establish which component generated every disk operation or network request. If the resource use changes after a supported repair, verify the feature still works before attributing causation. ## Can you stop or disable it? Removing account data or changing templates can affect multiple applications. Preserve unsynchronized changes and use the affected application's supported recovery path. A service disappearing when the user signs out can be expected lifecycle behavior. Do not delete registry templates or force a template into a permanent instance to repair one session. Compare another authorized session only when that comparison preserves user privacy and unsynchronized work. Treat stop, restart and disable as different operations. A restart interrupts current work; disabling changes future startup behavior. The ability to request a change does not establish that the change is safe, supported or permitted by organizational policy. This article intentionally gives inspection commands first rather than a universal stop or disable command. ## Recovery, confirmation and an escalation checklist Before an approved configuration change, record the original startup settings, service account, dependencies and relevant feature policy. Obtain a maintenance window and a known recovery access path when users, storage, authentication or remote administration could be affected. Keep backups and credential recovery material in their authorized secure location, not in a support transcript. Change one justified setting at a time using the product owner or administrator's supported procedure. If the result is worse, restore the recorded configuration through that same supported management path. Do not guess service permissions, replace the service account with an administrator, import registry keys from another Windows build or treat a working service start as proof that the application recovered. Confirm recovery by repeating the original operation, checking its result and comparing the service and application events over the same kind of workload. Verify that dependent functions still work and that the symptom does not immediately return. If the cause remains unclear, preserve the unsuccessful test as evidence rather than retrying destructive repairs. - Include the service identifier and actual instance name, Windows edition/build, affected feature and whether the device is managed. - Include time-stamped service state, dependency output, the exact application error and the relevant event provider and message. - Include the smallest reproduction, the supported changes attempted and their observed outcomes. - Redact passwords, recovery keys, access tokens, private keys, personal file content and unnecessary identifiers before sharing logs. ## Related These entities connect to this article. Type is shown on every link. [Identify the services inside svchost.exe: Diagnostic guide](https://feex.it/wiki/software/system/identify-services-inside-svchost/)[Verify an executable path and signature: Identity guide](https://feex.it/wiki/software/system/verify-executable-path-signature/)[Windows Event Log: Related service](https://feex.it/wiki/service/windows-event-log/) ## Sources and verification Editorial ownership: Feex. No independent review date is recorded. [How we research](https://feex.it/wiki/research/). - [Microsoft: Windows IoT Enterprise service guidance ](https://learn.microsoft.com/en-us/windows/iot/iot-enterprise/optimize/services)· Exact service row (OneSyncSvc). Windows 10/11 IoT Enterprise scope; not a universal configuration recommendation. - [Microsoft: Windows services architecture ](https://learn.microsoft.com/en-us/windows/win32/services/about-services)· Service lifecycle and management architecture; diagnostic interpretation below is Feex editorial guidance. - [Microsoft: Win32_Service properties ](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service)· Definitions of state, startup mode, service identity, process ID and configured executable path. - [Microsoft: Get-Service ](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-service?view=powershell-5.1)· Read-only service discovery and dependency inspection. Examples target Windows PowerShell. - [Microsoft: sc.exe query ](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-query)· Service-state output and service-name syntax. - [Microsoft: per-user services ](https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows)· Templates, dynamic suffixes and sign-in/sign-out lifecycle. [Report a correction to Feex](https://feex.it/contact/) ## Was this article useful? A yes or no is enough. Pick a reason if you want, or add a short note. Quick facts The short identity of this page. Specs, sources, and the full story stay in the article. - **Service identifier**: OneSyncSvc **Service category**: per-user **IoT reference startup**: Automatic; Windows IoT Enterprise documentation only, not a universal local default **Configuration baseline**: Inspect the installed Windows build and effective policy; no universal default is asserted. **Identity model**: Per-user template with session-specific instances --- Source: [Canonical Feex Wiki page](https://feex.it/wiki/service/sync-host/) [Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)